Online Lending App Harassment in the Philippines & the Legal Remedies Available (2025 update)

1. Why the Issue Matters

App-based “pay-day” or “quick cash” lenders exploded during the pandemic. Many of them scrape a borrower’s contact list and unleash relentless calls, threats or public shaming posts when repayments are late, often for amounts under ₱10 000. Complaints about these tactics now dominate consumer-finance dockets at the Securities and Exchange Commission (SEC), the National Privacy Commission (NPC) and the Bangko Sentral ng Pilipinas (BSP). (Moneymax)

2. Governing Laws & Regulations

Layer	Key Provisions	Highlights
Securities and Exchange Commission	• SEC Memorandum Circular 18-2019 – Prohibition on Unfair Debt-Collection Practices
• SEC Memorandum Circular 19-2019 – registration & in-app complaints channel for Online Lending Platforms (OLPs)	• Bans threats, profanities, contact-scraping, “debt shaming,” calls before 6 a.m. or after 10 p.m. (unless 15 days overdue)
• Penalties: ₱25 000–₱1 million per offense plus suspension or revocation of licence. (Credit Information Corporation, Credit Information Corporation)
Statutory Consumer Protection	RA 11765 – Financial Products and Services Consumer Protection Act (FPSCPA, 2022)	Elevates “fair-debt” rules to statutory level, empowers SEC/BSP to issue cease-and-desist orders (CDOs), impose fines up to ₱2 million and criminal liability up to five years. (Lawphil, BusinessWorld Online)
Data Privacy	RA 10173 – Data Privacy Act, NPC Circular 20-01 (2020)	Bars harvesting of phonebooks & social-media contacts; allows damages suits for unauthorized disclosure. NPC decisions (e.g., In re: JuanHand, 2024) ordered deletion of scraped data and payment of damages. (National Privacy Commission, National Privacy Commission)
Cybercrime & Penal Code	RA 10175 – Cybercrime Prevention Act
Revised Penal Code (RPC) Arts. 282 (grave threats), 287 (unjust vexation), 353/355 (libel)	Abusive collectors may face arrest; cyber-libel can now be punished with fine in lieu of prison under the 2023 SC ruling on online libel sentencing flexibility.
Other Sector-Specific Rules	BSP Circular 1160-2022 (credit-card collectors); RA 10870 (Credit-Card Industry Regulation); Consumer Act (RA 7394, subsumed where overlaps)	Require banks/e-money issuers to police third-party collectors and keep a single, free complaints channel. (RESPICIO & CO.)

3. How Regulators Enforce

SEC: Issues CDOs and revokes licences. Latest example: May 27 2025 CDO against Hupan Lending Technology for operating an unregistered OLP. (Philstar.com)
NPC: Investigates privacy breaches; may compel data erasure, award damages and impose administrative fines up to 5 % of annual gross income.
BSP: Handles banks, digital banks and EMI (e-wallet) collectors.
DICT/NTC: Coordinate take-downs of numbers or domains used for harassment.

4. Administrative Remedies for Borrowers

File a written, dated complaint with evidence (screenshots, call logs, repayment records).
Choose the right forum – SEC for licensed lending/financing companies; NPC if personal data were misused; BSP if the collector is a bank/e-money issuer; NTC if you need the perpetrator’s SIM blocked. (RESPICIO & CO.)
Free mediation window: RA 11765 now obliges providers to acknowledge complaints within 2 working days and resolve them in 15, before escalation.
Relief that can be granted:
- Issuance of a CDO stopping all collection while the case is pending;
- Suspension/revocation of the app’s certificate of authority;
- Administrative fines payable to the State and reimbursement of amounts illegally deducted or collected.

5. Criminal & Civil Actions

Offence	Typical Harassing Act	Where to File	Penalty Range
Grave threats (Art. 282 RPC)	“We’ll send NBI agents to arrest you”	DOJ / City Prosecutor	Prison correccional (6 mo-6 yr)
Unjust vexation (Art. 287 RPC)	50+ nuisance calls per day	Prosecutor / MTC	Fine or arresto menor (1-30 days)
Cyber-libel (RA 10175)	Posting borrower’s photo & debt on Facebook	Prosecutor / RTC Cybercrime	Fine (₱40 000-₱1 million) or prision correccional, per 2023 SC guidance.
Extortion/Robbery (Art. 294 RPC)	Collecting extra “processing fees” under threat of exposure	Prosecutor / RTC	Reclusion temporal (12-20 yrs)
Privacy breach (RA 10173)	Bulk-messaging all contacts in phonebook	NPC (administrative) + RTC (civil)	₱500 000-₱5 million fine; damages to the victim.

Victims may also sue for moral and exemplary damages or seek a writ of injunction to stop continuing harassment. Small-claims courts (≤ ₱400 000) are allowed for pure damages actions.

6. Building Your Evidence File

Preserve digital trails – enable on-screen date stamps; export chat threads to PDF.
Request a copy of the app-permission manifest from Google Play or the Apple App Store (useful in privacy cases).
Sworn certification of screenshots (Sec 1, Rule 11, Rules on Electronic Evidence) makes them admissible without further authentication.

7. Current Enforcement Snapshot (May 2025)

229 OLPs ordered delisted from Google Play since 2019; 33 apps removed in one sweep in 2023 alone. (RESPICIO & CO.)
₱78 million in administrative fines imposed by the SEC from 2022-Q1 2025.
NPC Decision JuanHand (2024) – first case to award actual damages (₱150 000) for group-text shaming and to order deletion of illegally harvested contacts. (National Privacy Commission)

8. Compliance Checklist for Lenders & Collectors

Display SEC licence & complaint e-mail in-app (MC 19-2019).
Collection windows: 6 a.m.–10 p.m.; max three calls per week per borrower (MC 18-2019).
No contact-scraping; only name & mobile number may be accessed, with clear consent (NPC Circular 20-01).
Dedicated complaints unit and 15-day resolution timeline (RA 11765).
Record & archive all calls for two years; make them available on request to regulators or the borrower.

9. Emerging Trends & Pending Legislation

Senate Bill No. 2391 (Gatchalian, 2025) – a stand-alone Fair Debt Collection Practices Act that would criminalise harassment per se and create a public blacklist of abusive collectors. (Philippine News Agency, Philippine Information Agency)
“Operation Cloud Sweep” – SEC, NBI and DICT joint task force launched Q4 2024 to trace offshore servers used by fly-by-night OLPs.
Cross-border cooperation with the Monetary Authority of Singapore (MAS) to curb apps registered in third-country cloud accounts.

10. Practical Action Plan for Borrowers

Pay what you legitimately owe (or negotiate). Good-faith payment – even partial – is the best defence.
Send a cease-and-desist demand quoting MC 18-2019 and RA 11765; give the lender 5 days to comply.
Escalate simultaneously to SEC (fraud@sec.gov.ph) and NPC (complaints@privacy.gov.ph) if personal data were misused.
File criminal charges if threats persist; attach the SEC/NPC docket numbers to strengthen probable cause.
Consider a civil suit for damages once administrative findings become final; they are admissible to prove bad-faith.

Key Take-aways

Harassment by online lenders is no longer a legal grey area; it can trigger administrative, civil and criminal liability.
The SEC’s MC 18-2019 remains the frontline rule, now reinforced by RA 11765 and by NPC privacy directives.
Evidence is digital and durable: screenshots, call-logs and app-permission manifests often clinch a case.
Victims should layer their remedies – administrative complaint, criminal case and, where worth it, a civil damages suit.
For lenders, compliance is existential: one credible complaint can now lead to delisting, multi-million-peso fines and even jail time for officers.

This article reflects Philippine law and regulatory practice as of 30 May 2025 and will be updated when the pending Fair Debt Collection bill is enacted.